DF-1617
No local guard against intval==0 in ath_beacon_config STA timer math
Summary
if_ath_beacon.c:988 intval = ni->ni_intval & HAL_BEACON_PERIOD. Divisions by intval at 1047/1060 (remainder), 1050/1062 (countdiff), 1117 (roundup divides by bs_intval). net80211 currently rejects bintval==0 via BPARSE_BINTVAL_INVALID (ieee80211_input.c:700-707) so unreachable today. If upstream gate weakened -> remote unauth DoS via forged beacon bintval=0. Fix: if(intval==0) goto done at head of ath_beacon_config.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1617 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 407 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/dev/netif/ath/ath/if_ath_beacon.c:988: no local guard against intval==0 in STA timer math
Verified recommended fix
Source-confirmed at sys/dev/netif/ath/ath/if_ath_beacon.c:988: no local guard against intval==0 in STA timer math
Verdict
Source-confirmed at sys/dev/netif/ath/ath/if_ath_beacon.c:988: no local guard against intval==0 in STA timer math
No comments yet.